⚡ MudraHQ Overview

MudraHQ is an enterprise-grade retail operating system, invoicing suite, and counter POS platform built specifically for Indian retail merchants, distributors, and SMEs.

It bridges high-throughput counter billing with Indian statutory compliance, including the Digital Personal Data Protection Act (DPDP Act 2023) and Section 36 of the CGST Act 2017.

🚀 Key Architectural Highlights

• Multi-Terminal POS Synchronization: Real-time counter billing across multiple tablets or desktop terminals with instant inventory decrements.
• Dual GST & Tax Intelligence: Automated split for CGST, SGST, IGST, and Cess across all 5-digit HSN and SAC classifications.
• ESC/POS & Thermal Printing: Browser-based thermal paper simulation with jagged edge tearing, plus raw network printing.
• DPDP Act 2023 Compliance:
  • Statutory Privacy Notice under Section 5.
  • Right to Erasure engine under Section 12 with automated PII anonymization.
  • Statutory Grievance Redressal Officer under Section 13 (under 30-day SLA).
  • Section 14 Nominee profile designations.
• Zero-Cost Production Email: Dual Brevo SMTP integration with simulated development fallback.
• Encrypted Cloud Vault: Automated daily encrypted database backup snapshots with SHA-256 verification directly to merchant Google Drive folders.

💻 System Architecture

graph TD    Client["📱 React Native Mobile / Expo Web (mudrahq.tech)"]    CF["🛡️ Cloudflare Anycast Edge (DDoS + Universal SSL)"]    Nginx["🌐 Nginx 1.24 Reverse Proxy (Oracle Cloud)"]    API["⚡ Node.js Cluster (PM2 on Ampere A1 ARM64)"]    DB[("🐘 PostgreSQL 15 Database (Docker)")]    Vault["☁️ Google Drive Encrypted Vault"]    Client --> CF    CF --> Nginx    Nginx -->|/api/| API    API --> DB    API --> Vault

🔌 API Endpoints Summary

Authentication & Tenant Control

• POST /api/auth/register — Merchant onboarding with explicit DPDP consent recording.
• POST /api/auth/login — Sliding-window rate-limited sign-in with BCrypt (12 rounds).
• POST /api/auth/google — Google Identity Services OAuth 2.0 verification.

Statutory Privacy & Governance

• GET /api/privacy/notice — Section 5 statutory privacy notice & CGST 72-month retention declaration.
• GET /api/privacy/grievance — Section 13 Grievance Redressal Officer contact details.
• POST /api/privacy/erasure-request — Section 12 Customer PII scrubbing with immutable audit logging.

Invoicing & Purchases

• GET /api/invoices — Unified search, filters by status (PAID, PENDING, OVERDUE).
• POST /api/invoices — Create GST-compliant tax invoice.
• GET /api/purchase-orders — Sequential PO generator with vendor inventory increment.

🔒 Security Baseline

MudraHQ is continuously audited against the OWASP Top 10 with 14/14 automated verification tests, including SSRF filters, SVG stored XSS blocking, CSV formula injection neutralization, and 1MB strict payload limits.